Yesterday, I had a chance, with some colleagues, to look over the new e-voting machines that will be used in the future here in Mercer County, New Jersey. They’re AVC Advantage machines, made by Sequoia. The machines were available for public inspection at Princeton Borough Hall. (They’re available today too, at the Suzanne Patterson Center, right behind Borough Hall.)

The machines have a low-tech user interface, a big board covered with a paper printout of the ballot, with switches underneath the paper. The paper is covered by a thin sheet of clear, flexible plastic. You press on the little box printed next to your candidate’s name, and a switch under the paper is triggered. A computer inside the machine detects the switch-press and lights a little green X next to the candidate’s name. When you’re done, you press a bright red “Cast Vote” button, which is supposed to cause the computer to record your vote.

The machine’s minders were careful not to let us look at the mechanism inside. When we got there the access panel was ajar; but when I asked whether I could look inside one of the minders quickly closed and locked it.

The physical security of the machine looked pretty lousy. The guts of the machine are behind a large plastic door on the back side of the machine. The door bent unexpectedly when I tugged gently on its corner. It seemed to be made out of an ordinary plastic, not the thick, tough kind used in kids’ toys these days. My guess is that I could probably rip off the door with my bare hands. It could certainly be removed with a screwdriver or crowbar. The lock looked wimpy too, like the kind of lock you might put on a toolshed or a locker at the gym; not as good as a standard house or office key. I doubt anyone could get the panel open during an election without being noticed, but that owes more to the number of people around than to the inherent strength of the door and lock. The machine will be physically vulnerable beforehand when it’s not as well attended.

They had a copy of the instruction manual that is normally given to poll workers, but they seemed nervous when we looked at it. It seemed to me that they were trying to decide whether to take the manual away from us. The manual had a small black-and-white photo of the machine’s innards, showing a circuit-board of some sort, and a printer.

The vendor offers little if any technical information about the machine. They do publish a brochure, which helpfully observes that use of these machines offers “[n]othing less than the complete elimination of human error.”

From Kim Zetter at wired.com comes the story at of the recent Napa County, California election. Napa County uses paper ballots that are marked by the voter with a pen or pencil, and counted by an optical scanner machine.

Due to a miscalibrated scanner, some valid votes went uncounted, as the scanner failed to detect the markings on some ballots. The problem was discovered during a random recount of one percent of precincts. The ballots are now being recounted with properly calibrated scanners, and the recount might well affect the election’s result.

Although a mistake was made in configuring the one scanner, the good news is that the system was robust enough to catch the problem. The main source of this robustness lies in the paper record, which could be manually examined to determine whether there was a problem, and could be recounted later when a problem was found. Another important factor was the random one percent recount, which brought the problem to light.

Our biggest fear in designing election technology should not be that we’ll make a mistake, but that we’ll make a mistake and fail to notice it. Paper records and random recounts help us notice mistakes and recover from them. Paperless e-voting systems don’t.

Did I mention that the Holt e-voting bill, H.R. 2239, requires paper trails and random recounts?

[Link via Peter Neumann’s RISKS Forum.]

Avi Rubin, the John Hopkins computer science professor and leading critic of e-voting, has posted a fascinating account of his day as an election judge in Baltimore, Maryland, using the new Diebold machines.

UPDATE (11:00 AM): It must be noted that the polling place where Avi worked was not typical. Everybody seemed to know in advance who he was. One of the other poll workers just happened to be an experienced Diebold trainer. Very senior Diebold executives just happened to show up before the polls opened to make sure everything was okay.

Today is a major primary election in several U.S. states. In Maryland, it will be the first use of the controversial new Diebold e-voting machines that were the subject of several negative security evaluations.

Unless there are very large, obvious problems today, expect stories later in the week in which e-voting advocates say there were no problems with the new machines. What they will really mean, of course, is that they didn’t notice any problems, which isn’t too surprising since the machines are essentially black boxes.

Avi Rubin, a prominent computer security expert and e-voting critic, is working as a volunteer election judge in Maryland. I’m eager to hear what he has to say after spending a day in the trenches.

A group of Californians has filed a lawsuit in state court against voting machine vendor Diebold, in advance of the March 2 primary election.

The complaint asks the court to order Diebold to do three main things: (1) to refrain from further violations of state election laws and regulations, such as installing uncertified software for use in elections, (2) to implement the stopgap security measures recommended by the Raba report, in time for the March 2 primary election, and (3) to implement the longterm security measures recommended by the Raba report or else to withdraw the Diebold systems from use.